FAQ

What Lumaft is

Does Lumaft need write access to my state bucket? No. It sends ListObjectsV2 and GetObject and nothing else. There is no configuration that makes it write, and its own tests confirm overwrite and delete attempts are refused under its grant. Connect a backend

Can Lumaft run, approve, or block a deployment? No. It is a record, and records do not have veto power. It never runs pulumi, never edits state, and never sits in a pipeline's critical path — a runner reports to it beside the deployment, and Lumaft being down never changes an exit code. Runner integration

Does it work with Pulumi Cloud? No. Lumaft reads DIY state in Amazon S3 or an S3-compatible store. Pulumi Cloud, the PostgreSQL state backend, Azure Blob, Google Cloud Storage, and local files have no adapter. Introduction

Does it support Terraform or OpenTofu? Within stated bounds. State observation is verified against Terraform 1.15.9 and OpenTofu 1.12.6; other builds are unverified. Terraform and OpenTofu can write native S3 lock files when locking is enabled, but Lumaft does not currently observe them. Backend-native update history remains unavailable for those engines, so lock and update-history observation are Pulumi-only and these backends answer engine-unsupported for both rather than showing empty results. Connect a backend

Can it tell me who ran a deployment? No. Pulumi DIY state carries no actor, and Lumaft does not invent one. Runner evidence carries the token's authority kind and name — credential provenance, not a person. Known limitations

Does it decrypt Pulumi secrets? No. Pulumi-marked secrets are redacted before they reach a browser model. Unmarked plaintext in an output is shown as Pulumi stored it, so treat the database as sensitive. Security and privacy

Setting up

How long does the first setup take? About fifteen minutes on a laptop with the Quickstart; an afternoon for a cloud deployment by hand; less with the Pulumi programs.

Why does the container run as UID 1000, and why do the docs keep saying chown? The process runs as the node user (ID 1000) and reads its secret files by numeric ID. On a Linux host a file you create as another user is unreadable inside the container until you chown 1000:1000 it. Docker Desktop on macOS and Windows maps ownership for you. Deployment and setup

Why won't it read my Kubernetes Secret or a projected file? Projected volumes materialize files as symlinks, and the file rules reject symlinks. Write the files into an emptyDir from an init container instead. Set up on Kubernetes

Can I put /data on EFS, NFS, or Azure Files? No. SQLite runs in WAL mode, which needs host-local locking. Use a block volume, or PostgreSQL. Deployment and setup

Can I run two replicas for high availability? On SQLite, no — the second refuses with ownership-conflict. On PostgreSQL with an Enterprise license, yes, up to a declared ceiling. PostgreSQL operations

Do I need PostgreSQL? Only if your compute cannot keep an exclusive block volume (Fargate, Container Apps), you need replicas, or you have measured SQLite past its envelope. SQLite is complete and supported. PostgreSQL operations

Which layout is my bucket? List .pulumi/stacks/ under your prefix: directories mean project-scoped, files directly there mean legacy. Lumaft never guesses. Find your backend details

Does pulling the image need a registry login? No. ghcr.io/dekglas/lumaft is public. Deploy by digest, verified with cosign; there is no latest tag. Upgrades and versioning

Using the console

I signed in and it bounced me back to the sign-in screen. The browser dropped the Secure session cookie because the page is plain HTTP. On a laptop over http://127.0.0.1, set LUMAFT_ALLOW_HTTP=true; anywhere else, put TLS in front and leave it unset. Troubleshooting

The backend diagnostic succeeded but Stacks is empty. Wrong layout or prefix, nine times out of ten. Backend problems

Why are there two rows for one deployment? One is the backend record, one is the runner's report. Lumaft stores the trusted join but this build keeps them as separately labelled rows. Reading the operation timeline

What does "Before coverage began" mean? You are looking at a window earlier than Lumaft's first observation of that stack. That interval is unknowable; history the backend pruned before then is gone. Coverage and gaps

Why is the Source filter disabled? It is not implemented in this build. The only option is All sources. Known limitations

Why does a failed operation show resource changes? Outcome and impact are separate facts. A failed update can have deleted things before it failed; a successful one can have changed nothing. Two questions every row answers

Can a viewer see everything? Every observation and operation, yes; no administration. Enterprise stack read scopes narrow retained history per user, but live observation pages stay installation-wide. Users and permissions

Why can't the administrator read a transcript? Transcript bodies need the distinct transcript-reader role, on purpose. Assign it to a separate account. Roles and permissions

Data and retention

How far back does history go? As far back as the backend still held update history when Lumaft first observed the stack, and forward from there forever (within retention). Nothing pruned earlier is reconstructed.

I purged a lot of evidence but the disk did not shrink. Deletion frees bytes inside the SQLite file; the file only shrinks after an offline VACUUM. Compacting

If I remove a backend and add it back, is the old history gone? No — but coverage restarts, tokens stop matching, and evidence that had expired is observed again as new with a fresh retention clock. Disable instead of removing. Changing your backends safely

Does a backup include everything? The database holds every account, token digest, observation, and audit row. It does not hold the transcript or state encryption keys; back those up separately or the bodies stay ciphertext. Backup and disaster recovery

Can I roll back an upgrade? Only by restoring the pre-upgrade backup. An older image refuses a newer schema and touches nothing. Upgrades and versioning

Does deleting evidence in Lumaft delete anything from my bucket? Never. Retention governs Lumaft's copy only.

Runners and CI

Do I have to use lumaft exec? No. A backend-only installation retains complete operation history. Runner integration adds previews, in progress/cancelled/incomplete outcomes, and planned-versus-actual comparison. The HTTP contract is public if you prefer your own client. Runner integration

What happens to my deployment if Lumaft is down? Nothing. The command runs unchanged, the exit code is its own, and the wrapper prints one warning. Undelivered evidence is lost; the backend observer still records the applying run.

Why does the runner get 404 for a stack I can see? The token's scope does not cover it. Out-of-scope and nonexistent stacks look identical to a token by design. Troubleshooting

Editions and licensing

What do I get without a license? Community: backend observation, the full operation timeline and resource history, up to 1 year of operation and resource history, local accounts with three fixed roles, integration tokens, export. No trial clock, no data truncation. Introduction

What happens when a license lapses? Nothing is deleted and no effective policy changes. Paid-only acts stop — placing a new hold, starting a new PostgreSQL adoption, assigning a custom role — while everything already in place stays. On Enterprise replicas, standbys stop serving and the primary continues. Edition downgrade

Can one license cover two installations? A connected Business or Enterprise agreement covers one installation, bound at first activation. Transfers and resets go through the licensing operator. Enterprise Advanced Security's offline site license is organization-wide. Decommissioning